Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. Qmail>
  3. users
Fwd: qmail + qmailscanner: problem with clamd
rejaine at bhz
Aug 26, 2015, 5:52 AM
Post #1 of 7 (3759 views)
Permalink
Hi people,

I'm using qmail+qmailscaner+clamav

ClamAV is failing with a permission denied error:

clamd[5609]: lstat() failed on:
/var/spool/qmailscan/tmp/rede2-div144059184580128654
2015-08-26T09:24:05.236584-03:00 rede2-div qmail-scanner-queue.pl:
X-Antivirus-div.jamef-1.25-st-qms:[rede2-div144059184580128654]
clamdscan: corrupt or unknown clamd scanner error or
memory/resource/perms problem - exit status 512/2

I alread change /var/spool/qmailscan/tmp to 777 , but problem persists.

# l /var/spool/qmailscan/tmp
drwxrwxrwx 2 qscand qscand 6 Ago 26 09:24 /var/spool/qmailscan/tmp

Clamd daemon is running with user qscand

# ps -ef | grep clamd
qscand 5609 1 0 09:19 ? 00:00:00 /usr/sbin/clamd

Dir /var/spool/qmailscan is a link to /home/sis/var/spool/qmailscan

# l /var/spool/qmailscan -d
lrwxrwxrwx 1 root root 29 Ago 21 14:44 /var/spool/qmailscan ->
/home/sis/var/spool/qmailscan/

... and /home/sis/var/spool/qmailscan is alread chmod to qscan

# l /home/sis/var/spool/qmailscan -d
drwxrwx--- 5 qscand qscand 4096 Ago 21 14:05 /home/sis/var/spool/qmailscan/

Dir /var/lib/clamav is a link to /home/sis/var/lib/clamav/

# l /var/lib/clamav -d
lrwxrwxrwx 1 root root 24 Ago 21 14:44 /var/lib/clamav ->
/home/sis/var/lib/clamav/

... and /home/sis/var/lib/clamav is alread chmod to qscan

# l /home/sis/var/lib/clamav -d
drwxrwxrwx 2 qscand users 109 Ago 26 09:19 /home/sis/var/lib/clamav/

I'm using OpenSuSE 13.2, but appamor deamon is not running

# ps -ef | grep -i apparmor
root 6874 17017 0 09:32 pts/2 00:00:00 grep --color=auto -i
apparmor


investigating the problem, I discovered that the files below spool/working and spool/tmp are being created with
root: nofiles rather than qscand: nofiles

Any ideas??
Re: Fwd: qmail + qmailscanner: problem with clamd [ In reply to ]
zakk at online
Aug 26, 2015, 6:11 AM
Post #2 of 7 (3737 views)
Permalink
On 26/08/2015 03:52 PM, Rejaine Monteiro wrote:
> Hi people,
>
> I'm using qmail+qmailscaner+clamav
>
> ClamAV is failing with a permission denied error:
>
> clamd[5609]: lstat() failed on:
> /var/spool/qmailscan/tmp/rede2-div144059184580128654
> 2015-08-26T09:24:05.236584-03:00 rede2-div qmail-scanner-queue.pl:
> X-Antivirus-div.jamef-1.25-st-qms:[rede2-div144059184580128654]
> clamdscan: corrupt or unknown clamd scanner error or
> memory/resource/perms problem - exit status 512/2
>
> I alread change /var/spool/qmailscan/tmp to 777 , but problem
> persists.
>
> # l /var/spool/qmailscan/tmp
> drwxrwxrwx 2 qscand qscand 6 Ago 26 09:24 /var/spool/qmailscan/tmp
>
> Clamd daemon is running with user qscand
>
> # ps -ef | grep clamd
> qscand 5609 1 0 09:19 ? 00:00:00 /usr/sbin/clamd
>
> Dir /var/spool/qmailscan is a link to /home/sis/var/spool/qmailscan
>
> # l /var/spool/qmailscan -d
> lrwxrwxrwx 1 root root 29 Ago 21 14:44 /var/spool/qmailscan ->
> /home/sis/var/spool/qmailscan/
>
> ... and /home/sis/var/spool/qmailscan is alread chmod to qscan
>
> # l /home/sis/var/spool/qmailscan -d
> drwxrwx--- 5 qscand qscand 4096 Ago 21 14:05
> /home/sis/var/spool/qmailscan/
>
> Dir /var/lib/clamav is a link to /home/sis/var/lib/clamav/
>
> # l /var/lib/clamav -d
> lrwxrwxrwx 1 root root 24 Ago 21 14:44 /var/lib/clamav ->
> /home/sis/var/lib/clamav/
>
> ... and /home/sis/var/lib/clamav is alread chmod to qscan
>
> # l /home/sis/var/lib/clamav -d
> drwxrwxrwx 2 qscand users 109 Ago 26 09:19 /home/sis/var/lib/clamav/
>
> I'm using OpenSuSE 13.2, but appamor deamon is not running
>
> # ps -ef | grep -i apparmor
> root 6874 17017 0 09:32 pts/2 00:00:00 grep --color=auto -i
> apparmor
>
>
> investigating the problem, I discovered that the files below
> spool/working and spool/tmp are being created with
> root: nofiles rather than qscand: nofiles
>
> Any ideas??

Can you post your "run" files? Also, try to increase the memory of
qmail-smtpd.
Re: Fwd: qmail + qmailscanner: problem with clamd [ In reply to ]
networks777 at gmail
Aug 26, 2015, 6:28 AM
Post #3 of 7 (3731 views)
Permalink
After permissions you could also restart clamd. After some upgrades, fixing
permissions, restarting clamd does fix a few issues. Please try.

On Wed, Aug 26, 2015 at 8:11 AM, Todor Petkov <zakk@online.bg> wrote:

> On 26/08/2015 03:52 PM, Rejaine Monteiro wrote:
>
>> Hi people,
>>
>> I'm using qmail+qmailscaner+clamav
>>
>> ClamAV is failing with a permission denied error:
>>
>> clamd[5609]: lstat() failed on:
>> /var/spool/qmailscan/tmp/rede2-div144059184580128654
>> 2015-08-26T09:24:05.236584-03:00 rede2-div qmail-scanner-queue.pl:
>> X-Antivirus-div.jamef-1.25-st-qms:[rede2-div144059184580128654]
>> clamdscan: corrupt or unknown clamd scanner error or
>> memory/resource/perms problem - exit status 512/2
>>
>> I alread change /var/spool/qmailscan/tmp to 777 , but problem persists.
>>
>> # l /var/spool/qmailscan/tmp
>> drwxrwxrwx 2 qscand qscand 6 Ago 26 09:24 /var/spool/qmailscan/tmp
>>
>> Clamd daemon is running with user qscand
>>
>> # ps -ef | grep clamd
>> qscand 5609 1 0 09:19 ? 00:00:00 /usr/sbin/clamd
>>
>> Dir /var/spool/qmailscan is a link to /home/sis/var/spool/qmailscan
>>
>> # l /var/spool/qmailscan -d
>> lrwxrwxrwx 1 root root 29 Ago 21 14:44 /var/spool/qmailscan ->
>> /home/sis/var/spool/qmailscan/
>>
>> ... and /home/sis/var/spool/qmailscan is alread chmod to qscan
>>
>> # l /home/sis/var/spool/qmailscan -d
>> drwxrwx--- 5 qscand qscand 4096 Ago 21 14:05
>> /home/sis/var/spool/qmailscan/
>>
>> Dir /var/lib/clamav is a link to /home/sis/var/lib/clamav/
>>
>> # l /var/lib/clamav -d
>> lrwxrwxrwx 1 root root 24 Ago 21 14:44 /var/lib/clamav ->
>> /home/sis/var/lib/clamav/
>>
>> ... and /home/sis/var/lib/clamav is alread chmod to qscan
>>
>> # l /home/sis/var/lib/clamav -d
>> drwxrwxrwx 2 qscand users 109 Ago 26 09:19 /home/sis/var/lib/clamav/
>>
>> I'm using OpenSuSE 13.2, but appamor deamon is not running
>>
>> # ps -ef | grep -i apparmor
>> root 6874 17017 0 09:32 pts/2 00:00:00 grep --color=auto -i
>> apparmor
>>
>>
>> investigating the problem, I discovered that the files below
>> spool/working and spool/tmp are being created with
>> root: nofiles rather than qscand: nofiles
>>
>> Any ideas??
>>
>
> Can you post your "run" files? Also, try to increase the memory of
> qmail-smtpd.
>
Re: Fwd: qmail + qmailscanner: problem with clamd [ In reply to ]
rejaine at bhz
Aug 26, 2015, 6:42 AM
Post #4 of 7 (3736 views)
Permalink
I commented on file qmail-scanner-queue.pl to not remove the tmp files.
I think the problem is that the files are being created as root owner
(see bellow).

# l /var/qmail/bin/qmail-scanner-queue.pl
-rwsr-xr-x 1 qscand users 136106 Ago 26 10:33
/var/qmail/bin/qmail-scanner-queue.pl*

l /var/spool/qmailscan/tmp
total 12
drwxrwxrwx 29 qscand users 4096 Ago 26 10:40 ./
drwxrwx--- 5 qscand qscand 4096 Ago 26 10:12 ../
drwx------ 2 root nofiles 80 Ago 26 10:13 rede2-div144059479480110577/
drwx------ 2 root nofiles 80 Ago 26 10:13 rede2-div144059479780111377/
drwx------ 2 root nofiles 153 Ago 26 10:16 rede2-div144059496280120550/
drwx------ 2 root nofiles 112 Ago 26 10:17 rede2-div14405950228013436/
drwx------ 2 root nofiles 78 Ago 26 10:17 rede2-div14405950338016514/
drwx------ 2 root nofiles 78 Ago 26 10:17 rede2-div14405950338016515/
drwx------ 2 root nofiles 115 Ago 26 10:17 rede2-div144059506980115291/
drwx------ 2 root nofiles 115 Ago 26 10:17 rede2-div144059507080115294/
drwx------ 2 root nofiles 115 Ago 26 10:17 rede2-div144059507080115330/
drwx------ 2 root nofiles 115 Ago 26 10:18 rede2-div144059508480118699/


On 26-08-2015 10:28, esoterico network wrote:
> After permissions you could also restart clamd. After some upgrades,
> fixing permissions, restarting clamd does fix a few issues. Please try.
>
> On Wed, Aug 26, 2015 at 8:11 AM, Todor Petkov <zakk@online.bg
> <mailto:zakk@online.bg>> wrote:
>
> On 26/08/2015 03:52 PM, Rejaine Monteiro wrote:
>
> Hi people,
>
> I'm using qmail+qmailscaner+clamav
>
> ClamAV is failing with a permission denied error:
>
> clamd[5609]: lstat() failed on:
> /var/spool/qmailscan/tmp/rede2-div144059184580128654
> 2015-08-26T09:24:05.236584-03:00 rede2-div
> qmail-scanner-queue.pl <http://qmail-scanner-queue.pl>:
> X-Antivirus-div.jamef-1.25-st-qms:[rede2-div144059184580128654]
> clamdscan: corrupt or unknown clamd scanner error or
> memory/resource/perms problem - exit status 512/2
>
> I alread change /var/spool/qmailscan/tmp to 777 , but
> problem persists.
>
> # l /var/spool/qmailscan/tmp
> drwxrwxrwx 2 qscand qscand 6 Ago 26 09:24 /var/spool/qmailscan/tmp
>
> Clamd daemon is running with user qscand
>
> # ps -ef | grep clamd
> qscand 5609 1 0 09:19 ? 00:00:00 /usr/sbin/clamd
>
> Dir /var/spool/qmailscan is a link to
> /home/sis/var/spool/qmailscan
>
> # l /var/spool/qmailscan -d
> lrwxrwxrwx 1 root root 29 Ago 21 14:44 /var/spool/qmailscan ->
> /home/sis/var/spool/qmailscan/
>
> ... and /home/sis/var/spool/qmailscan is alread chmod to qscan
>
> # l /home/sis/var/spool/qmailscan -d
> drwxrwx--- 5 qscand qscand 4096 Ago 21 14:05
> /home/sis/var/spool/qmailscan/
>
> Dir /var/lib/clamav is a link to /home/sis/var/lib/clamav/
>
> # l /var/lib/clamav -d
> lrwxrwxrwx 1 root root 24 Ago 21 14:44 /var/lib/clamav ->
> /home/sis/var/lib/clamav/
>
> ... and /home/sis/var/lib/clamav is alread chmod to qscan
>
> # l /home/sis/var/lib/clamav -d
> drwxrwxrwx 2 qscand users 109 Ago 26 09:19
> /home/sis/var/lib/clamav/
>
> I'm using OpenSuSE 13.2, but appamor deamon is not running
>
> # ps -ef | grep -i apparmor
> root 6874 17017 0 09:32 pts/2 00:00:00 grep
> --color=auto -i
> apparmor
>
>
> investigating the problem, I discovered that the files below
> spool/working and spool/tmp are being created with
> root: nofiles rather than qscand: nofiles
>
> Any ideas??
>
>
> Can you post your "run" files? Also, try to increase the memory of
> qmail-smtpd.
>
>

--
Rejaine da Silveira Monteiro
Suporte-TI
Tel: (31) 2102-8854
rejaine@bhz.jamef.com.br
www.jamef.com.br
Re: Fwd: qmail + qmailscanner: problem with clamd [ In reply to ]
pat at linuxcolumbus
Aug 26, 2015, 6:58 AM
Post #5 of 7 (3737 views)
Permalink
On 2015-08-26 09:42, Rejaine Monteiro wrote:

> I commented on file qmail-scanner-queue.pl to not remove the tmp files.
> I think the problem is that the files are being created as root owner
> (see bellow).
>
> # l /var/qmail/bin/qmail-scanner-queue.pl
> -rwsr-xr-x 1 qscand users 136106 Ago 26 10:33
> /var/qmail/bin/qmail-scanner-queue.pl*
>
> l /var/spool/qmailscan/tmp
> total 12
> drwxrwxrwx 29 qscand users 4096 Ago 26 10:40 ./
> drwxrwx--- 5 qscand qscand 4096 Ago 26 10:12 ../
> drwx------ 2 root nofiles 80 Ago 26 10:13 rede2-div144059479480110577/
> drwx------ 2 root nofiles 80 Ago 26 10:13 rede2-div144059479780111377/
> drwx------ 2 root nofiles 153 Ago 26 10:16 rede2-div144059496280120550/
> drwx------ 2 root nofiles 112 Ago 26 10:17 rede2-div14405950228013436/
> drwx------ 2 root nofiles 78 Ago 26 10:17 rede2-div14405950338016514/
> drwx------ 2 root nofiles 78 Ago 26 10:17 rede2-div14405950338016515/
> drwx------ 2 root nofiles 115 Ago 26 10:17 rede2-div144059506980115291/
> drwx------ 2 root nofiles 115 Ago 26 10:17 rede2-div144059507080115294/
> drwx------ 2 root nofiles 115 Ago 26 10:17 rede2-div144059507080115330/
> drwx------ 2 root nofiles 115 Ago 26 10:18 rede2-div144059508480118699/
>


I run qmail-scanner-queue.pl with a c wrapper that runs as
qscand:nofiles.

#define REAL_PATH "/var/qmail/bin/qmail-scanner-queue.pl"
main(ac, av)
char **av;
{
setuid( 210 );
setgid( 210 );
execv( REAL_PATH, av );
}

(210 is qscand on my system)


Pat
Re: Fwd: qmail + qmailscanner: problem with clamd [ In reply to ]
ed-qmail at s5h
Aug 26, 2015, 10:26 AM
Post #6 of 7 (3732 views)
Permalink
On Wed, Aug 26, 2015 at 09:58:04AM -0400, Pat wrote:
> I run qmail-scanner-queue.pl with a c wrapper that runs as
> qscand:nofiles.
>
> #define REAL_PATH "/var/qmail/bin/qmail-scanner-queue.pl"
> main(ac, av)
> char **av;
> {
> setuid( 210 );
> setgid( 210 );
> execv( REAL_PATH, av );
> }
>
> (210 is qscand on my system)

Why not use setuidgid which is part of daemontools?

$ setuidgid
setuidgid: usage: setuidgid account child

So you could do:

$ setuidgid qscand qscand /var/qmail/bin/qmail-scanner-queue.pl

HTH

--
Best regards,
Ed http://www.s5h.net/
Re: Fwd: qmail + qmailscanner: problem with clamd [ In reply to ]
Jason_Haar at trimble
Aug 26, 2015, 1:15 PM
Post #7 of 7 (3727 views)
Permalink
On 27/08/15 00:52, Rejaine Monteiro wrote:
> investigating the problem, I discovered that the files below
> spool/working and spool/tmp are being created with
> root: nofiles rather than qscand: nofiles
You have setuid root qmail-scanner-queue.pl instead of setuid-ing it to
qscand. No file should ever be created as root by any of these processes

--
Cheers

Jason Haar
Corporate Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal